6.1 Identify and Describe Troubleshooting Issues Related to Insufficient Cloud Service Provider (CSP) IAM Permissions, CloudFormation / Terraform Stack Failures, and Organization-Level Onboarding Related Errors, Including Ingestion CLOUD-SECURITY-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security engineer is deploying a CloudFormation stack that creates an S3 bucket and an IAM role. The stack creation fails with the error: 'API: iam:CreateRole Access Denied'. The engineer has full administrator access in the AWS account. What is the most likely cause?

   • AA service control policy (SCP) in the organization is denying the iam:CreateRole action.
   • BThe IAM role name in the template conflicts with an existing role.
   • CThe CloudFormation stack is in a region that does not support IAM.
   • DThe S3 bucket name in the template is not globally unique.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During organization-level onboarding of a new AWS account, the account appears in the organization but cannot be managed by the delegated administrator. What is the most likely cause?

   • AThe delegated administrator does not have the required IAM permissions in the management account.
   • BThe service control policy (SCP) attached to the account denies the delegated administrator's actions.
   • CThe account is not part of the organization's root organizational unit.
   • DThe account's root user credentials are not available.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After onboarding an AWS account into Prisma Cloud, the engineer notices that CloudTrail logs are not being ingested. The CloudTrail trail is configured correctly and the IAM role has the required permissions. What is the most likely cause of the ingestion failure?

   • AThe S3 bucket that stores the CloudTrail logs has a bucket policy that denies Prisma Cloud access.
   • BThe CloudTrail trail is not enabled in the same region as the Prisma Cloud collector.
   • CThe CloudTrail trail is not logging data events.
   • DThe CloudTrail logs are in gzip format, which Prisma Cloud cannot parse.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A cloud security engineer is onboarding an entire AWS Organization into Prisma Cloud. The management account is onboarded successfully, but member accounts show an error: 'Failed to onboard account: The account is not part of the organization.' The engineer verifies that the member accounts are indeed in the organization. What is the most likely cause?

   • AThe member accounts are in a different AWS region than the management account.
   • BThe member accounts have not enabled AWS Config.
   • CThe member accounts have not been granted the required IAM permissions to be read by Prisma Cloud.
   • DThe organization onboarding was initiated from a delegated administrator account that does not have permission to list all member accounts.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A DevOps engineer runs `terraform apply` to deploy a Palo Alto Networks VM-Series firewall in AWS. The apply fails with the error: 'Error creating security group: InvalidGroup.Duplicate: The security group 'sg-app' already exists.' The engineer confirms the security group exists in the AWS account. What is the most likely cause of this Terraform failure?

   • AThe AWS provider version is too old to support security groups.
   • BThe security group is in a different VPC than the one specified in the Terraform configuration.
   • CThe Terraform configuration uses a hardcoded security group ID instead of a resource reference.
   • DThe Terraform state file is out of sync with the actual AWS resources.
   Reveal Solution Discussion Select an answer first